PyOTP 2.7.0__tar.gz → 2.8.0__tar.gz

{pyotp-2.7.0/src/pyotp.egg-info → pyotp-2.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pyotp
-Version: 2.7.0
+Version: 2.8.0
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
@@ -20,7 +20,7 @@ Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.6
+Requires-Python: >=3.7
 License-File: LICENSE
 
 PyOTP - The Python One-Time Password Library
@@ -45,7 +45,7 @@ minimum, application implementers should follow this checklist:
 - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
 - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
   recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
-- Throttle (rate limit) brute-force attacks against your application's login functionality
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
   addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
@@ -80,6 +80,9 @@ Time-based OTPs
 ~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    import time
+
     totp = pyotp.TOTP('base32secret3232')
     totp.now() # => '492039'
 
@@ -92,6 +95,8 @@ Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    
     hotp = pyotp.HOTP('base32secret3232')
     hotp.at(0) # => '260182'
     hotp.at(1) # => '055283'

{pyotp-2.7.0 → pyotp-2.8.0}/README.rst

@@ -20,7 +20,7 @@ minimum, application implementers should follow this checklist:
 - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
 - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
   recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
-- Throttle (rate limit) brute-force attacks against your application's login functionality
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
   addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
@@ -55,6 +55,9 @@ Time-based OTPs
 ~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    import time
+
     totp = pyotp.TOTP('base32secret3232')
     totp.now() # => '492039'
 
@@ -67,6 +70,8 @@ Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    
     hotp = pyotp.HOTP('base32secret3232')
     hotp.at(0) # => '260182'
     hotp.at(1) # => '055283'

{pyotp-2.7.0 → pyotp-2.8.0}/setup.py

@@ -4,14 +4,14 @@ from setuptools import setup
 
 setup(
     name="pyotp",
-    version="2.7.0",
+    version="2.8.0",
     url="https://github.com/pyotp/pyotp",
     license="MIT License",
     author="PyOTP contributors",
     author_email="kislyuk@gmail.com",
     description="Python One Time Password Library",
     long_description=open("README.rst").read(),
-    python_requires=">=3.6",
+    python_requires=">=3.7",
     install_requires=[],
     packages=["pyotp", "pyotp.contrib"],
     package_dir={"": "src"},

{pyotp-2.7.0 → pyotp-2.8.0}/src/pyotp/__init__.py

@@ -41,7 +41,7 @@ def parse_uri(uri: str) -> OTP:
     secret = None
 
     # Data we'll parse to the correct constructor
-    otp_data = {}  # type: Dict[str, Any]
+    otp_data: Dict[str, Any] = {}
 
     # Parse with URLlib
     parsed_uri = urlparse(unquote(uri))

{pyotp-2.7.0 → pyotp-2.8.0}/src/pyotp/hotp.py

@@ -14,7 +14,7 @@ class HOTP(OTP):
         self,
         s: str,
         digits: int = 6,
-        digest: Any = hashlib.sha1,
+        digest: Any = None,
         name: Optional[str] = None,
         issuer: Optional[str] = None,
         initial_count: int = 0,
@@ -23,10 +23,13 @@ class HOTP(OTP):
         :param s: secret in base32 format
         :param initial_count: starting HMAC counter value, defaults to 0
         :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.
-        :param digest: digest function to use in the HMAC (expected to be sha1)
+        :param digest: digest function to use in the HMAC (expected to be SHA1)
         :param name: account name
         :param issuer: issuer
         """
+        if digest is None:
+            digest = hashlib.sha1
+
         self.initial_count = initial_count
         super().__init__(s=s, digits=digits, digest=digest, name=name, issuer=issuer)
 

{pyotp-2.7.0 → pyotp-2.8.0}/src/pyotp/otp.py

@@ -18,6 +18,8 @@ class OTP(object):
         issuer: Optional[str] = None,
     ) -> None:
         self.digits = digits
+        if digits > 10:
+            raise ValueError("digits must be no greater than 10")
         self.digest = digest
         self.secret = s
         self.name = name or "Secret"
@@ -39,11 +41,8 @@ class OTP(object):
             | (hmac_hash[offset + 2] & 0xFF) << 8
             | (hmac_hash[offset + 3] & 0xFF)
         )
-        str_code = str(code % 10**self.digits)
-        while len(str_code) < self.digits:
-            str_code = "0" + str_code
-
-        return str_code
+        str_code = str(10_000_000_000 + (code % 10**self.digits))
+        return str_code[-self.digits :]
 
     def byte_secret(self) -> bytes:
         secret = self.secret

{pyotp-2.7.0 → pyotp-2.8.0}/src/pyotp/totp.py

@@ -17,7 +17,7 @@ class TOTP(OTP):
         self,
         s: str,
         digits: int = 6,
-        digest: Any = hashlib.sha1,
+        digest: Any = None,
         name: Optional[str] = None,
         issuer: Optional[str] = None,
         interval: int = 30,
@@ -26,10 +26,13 @@ class TOTP(OTP):
         :param s: secret in base32 format
         :param interval: the time interval in seconds for OTP. This defaults to 30.
         :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.
-        :param digest: digest function to use in the HMAC (expected to be sha1)
+        :param digest: digest function to use in the HMAC (expected to be SHA1)
         :param name: account name
         :param issuer: issuer
         """
+        if digest is None:
+            digest = hashlib.sha1
+
         self.interval = interval
         super().__init__(s=s, digits=digits, digest=digest, name=name, issuer=issuer)
 
@@ -37,7 +40,9 @@ class TOTP(OTP):
         """
         Accepts either a Unix timestamp integer or a datetime object.
 
-        To get the time until the next timecode change (seconds until the current OTP expires), use this instead::
+        To get the time until the next timecode change (seconds until the current OTP expires), use this instead:
+
+        .. code:: python
 
             totp = pyotp.TOTP(...)
             time_remaining = totp.interval - datetime.datetime.now().timestamp() % totp.interval

{pyotp-2.7.0 → pyotp-2.8.0}/src/pyotp/utils.py

@@ -49,7 +49,7 @@ def build_uri(
     otp_type = "hotp" if is_initial_count_present else "totp"
     base_uri = "otpauth://{0}/{1}?{2}"
 
-    url_args = {"secret": secret}  # type: Dict[str, Union[None, int, str]]
+    url_args: Dict[str, Union[None, int, str]] = {"secret": secret}
 
     label = quote(name)
     if issuer is not None:

{pyotp-2.7.0 → pyotp-2.8.0/src/pyotp.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pyotp
-Version: 2.7.0
+Version: 2.8.0
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
@@ -20,7 +20,7 @@ Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.6
+Requires-Python: >=3.7
 License-File: LICENSE
 
 PyOTP - The Python One-Time Password Library
@@ -45,7 +45,7 @@ minimum, application implementers should follow this checklist:
 - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
 - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
   recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
-- Throttle (rate limit) brute-force attacks against your application's login functionality
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
   addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
@@ -80,6 +80,9 @@ Time-based OTPs
 ~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    import time
+
     totp = pyotp.TOTP('base32secret3232')
     totp.now() # => '492039'
 
@@ -92,6 +95,8 @@ Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    
     hotp = pyotp.HOTP('base32secret3232')
     hotp.at(0) # => '260182'
     hotp.at(1) # => '055283'